When the factory floor meets the network: OT/IT convergence without the jargon
OT/IT convergence means the machines on your factory floor now share networks with your office systems, your suppliers and the internet. That brings real benefits, such as remote support and live production data. It also means a problem that starts on the office side can reach the line. The answer is knowing what’s connected and controlling the joins.
What is OT, and how is it different from IT?
OT, or operational technology, is the kit that runs and monitors physical production: PLCs, HMIs, SCADA, drives and the engineering workstations used to program them. IT is email, ERP, files and finance. The difference that matters is priorities. In OT, safety and keeping the line running come first, and the kit is built for reliability and a long working life.
That changes how security works. You can’t reboot a PLC mid-shift the way you’d restart a laptop, and some controllers can’t be updated at all. Make UK puts it plainly in its 2026 report: “Machinery that was once isolated is now linked to business systems, cloud platforms, suppliers and remote monitoring tools.”
It also offers a practical test. Could a cyber event or an unauthorised change create a hazardous situation? If the answer is yes, Make UK says the issue must be managed as both a cyber risk and a machinery safety risk.
Why does OT/IT convergence matter right now?
Because attackers are looking at it. On 27 August 2026 the NCSC warned of increased targeting of OT systems across multiple sectors, including in the UK, with some limited real-world disruption. It told organisations not to assume their OT can’t be reached from the internet without checking, because exposure can come from misconfigurations, legacy connections or unmanaged assets.
The NCSC advisory says any organisation with internet-exposed OT could be affected. Globally, manufacturing is already the main victim of industrial ransomware. The Dragos 2026 OT/ICS report found:
- ransomware groups hit 3,300 industrial organisations worldwide in 2025, and manufacturing accounted for more than two-thirds of victims;
- ransomware sat in OT environments for 42 days on average, while organisations with full OT visibility detected and contained it in 5 days;
- OT incidents are often wrongly treated as “IT only”, because HMIs and engineering workstations run Windows and get classed as IT.
That last point is where many mid-sized firms get caught. The HMI on the line is a Windows PC. If nobody owns it, nobody updates it, backs it up or watches it.
Is our OT really air-gapped?
Probably not completely. Most factories have more connections than anyone has written down: a machine builder’s remote support tool, a 4G router fitted during installation, ERP or MES pulling production data, a shared Windows domain, and USB sticks. Each one exists for a good reason. The risk is when nobody knows it’s there or who can use it.
| Connection | Why it’s there | What can go wrong | A sensible control |
|---|---|---|---|
| Machine builder remote access | Faster fault fixing | Always-on access with a shared password | Named accounts, MFA, switched on only when needed |
| 4G or broadband router on a machine | Installed for support or monitoring | A route round your firewall nobody knows about | Find it, remove it or bring it behind your boundary |
| ERP or MES data feed | Live production and stock data | A path from office malware to the line | Allow only the specific flows needed |
| Shared office and production network | It was simpler at the time | One infection reaches everything | Separate zones with controlled links |
| USB sticks for programs and recipes | Updating machines | Malware carried in by hand | Scanned, controlled media |
What should a mid-sized manufacturer do first?
Start by finding out what’s connected, then close the joins you don’t need and control the ones you do. You don’t need a big programme. A short piece of work on assets, internet exposure, passwords, supplier access and network separation closes many of the easy routes in. Then plan how you’d isolate the factory if you had to.
The NCSC’s August advisory and its secure connectivity principles for OT, led by the NCSC and published with CISA, the FBI and other partners on 14 January 2026, point to the same first steps:
- Build a definitive view. List OT assets, how they communicate and every external connection.
- Take OT off the public internet. PLCs and HMIs should not be directly reachable.
- Replace default passwords. Use unique admin accounts and MFA wherever the kit supports it.
- Harden the boundary. Keep firewalls, gateways and remote access devices supported and updated, and replace them before end of life.
- Separate and plan isolation. Split office and production networks, and write and test a plan to cut the factory off from outside connections, including how suppliers would then support you on site (NCSC principle 8).
None of this means touching PLC logic. It’s the IT around the machines: the network, access and the Windows PCs that sit beside them.
Who should own OT security: IT or engineering?
Both, with one named person accountable. IT understands networks and access. Engineering understands the machines, the safety case and the supplier contracts. Make UK says OT governance has to be joined up across engineering, production, maintenance, IT, health and safety, procurement and senior leadership, because machinery risk cuts across all of them.
In practice that means agreeing three things in writing:
- How changes are approved. Nothing changes on the line without engineering’s sign-off.
- How suppliers get access. Who approves it, how it’s logged and how it’s switched off.
- How incidents are escalated. Who decides whether to isolate the factory, and how quickly.
Make UK found only 45% of manufacturers have a senior leader responsible for cyber security. Naming one is free.
Key takeaways
- OT/IT convergence is normal and useful. The risk is connections nobody has mapped or owns.
- The NCSC warned in August 2026 of increased targeting of OT, including in the UK.
- Manufacturing was more than two-thirds of industrial ransomware victims in 2025 (Dragos).
- Start with an asset list, no direct internet exposure, unique passwords, controlled supplier access and separate networks.
- Give OT security one named owner, with engineering and IT both involved.
Frequently asked questions
What is OT/IT convergence in manufacturing?
It’s the joining of factory systems, such as PLCs, HMIs and SCADA, with business IT, cloud services and supplier connections. It enables remote support and live production data, but it also means a cyber incident on the office side can reach production unless the connections are mapped and controlled.
Is OT security different from IT security?
Yes. OT puts safety and availability first, so you can’t always patch or reboot on IT timescales, and some kit can’t be updated at all. Controls focus on separating networks, limiting access and monitoring the boundary. The NCSC accepts that “update by default” may not apply to OT.
Should machine builders have remote access to our equipment?
They can, if it’s controlled. Give each supplier named accounts with MFA, limit access to the machines they support, log it, and switch it on only when needed. The NCSC’s OT principles recommend designing access so a compromised third party can be cut off quickly.
Do we need IEC 62443 for our factory?
Not usually as a first step. IEC 62443 is a series of standards for industrial control system security, and some industrial customers ask their suppliers to follow it. Most mid-sized manufacturers get more value first from its core ideas: separate zones, controlled connections and secure remote access.
TekXera looks after the IT side of that boundary for UK businesses: the network, access and the servers production systems rely on. If you’d like a second view of where your office and factory networks meet, our CTO runs a free IT assessment.
